Office (OLE) malware analysis — malicious · 66c6f44e5390904f

MALICIOUS

Office (OLE)

19.5 KB First seen: 2015-01-15

MD5: 5b1c1a173852f6461c2eef07af419793 SHA-1: d9d67afaad5f53b74177ae049c01d5de3962bdcc SHA-256: 66c6f44e5390904f7888db4bc169e760a9016b77d63e29016bb8c6499ff824da

100 Risk Score

Malware Insights

MITRE ATT&CK

T1203 Exploitation for Client Execution

The critical ClamAV heuristic firing indicates the file is an exploit targeting Microsoft Excel. The presence of a NOP sled further supports this, suggesting shellcode execution. Without further script or URL evidence, the exact payload and delivery mechanism remain unknown, but the primary function is code execution via exploitation.

Heuristics 2

ClamAV: Xls.Exploit.Generic-1593 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Xls.Exploit.Generic-1593

NOP sled detected high SC_NOP_SLED

Found 20+ consecutive 0x90 bytes

Disassembly

Attempted x86 opcode disassembly

00000631  90                nop
00000632  90                nop
00000633  90                nop
00000634  90                nop
00000635  90                nop
00000636  90                nop
00000637  90                nop
00000638  90                nop
00000639  90                nop
0000063A  90                nop
0000063B  90                nop
0000063C  90                nop
0000063D  90                nop
0000063E  90                nop
0000063F  90                nop
00000640  90                nop
00000641  90                nop
00000642  90                nop
00000643  90                nop
00000644  90                nop
00000645  90                nop
00000646  90                nop
00000647  90                nop
00000648  90                nop
00000649  90                nop
0000064A  90                nop
0000064B  90                nop
0000064C  90                nop
0000064D  90                nop
0000064E  90                nop
0000064F  90                nop
00000650  90                nop
00000651  90                nop
00000652  90                nop
00000653  90                nop
00000654  90                nop
00000655  90                nop
00000656  90                nop
00000657  90                nop
00000658  90                nop
00000659  90                nop
0000065A  90                nop
0000065B  90                nop
0000065C  90                nop
0000065D  90                nop
0000065E  90                nop
0000065F  90                nop
00000660  90                nop
00000661  90                nop
00000662  90                nop
00000663  90                nop
00000664  90                nop
00000665  90                nop
00000666  90                nop
00000667  90                nop
00000668  90                nop
00000669  90                nop
0000066A  90                nop
0000066B  90                nop
0000066C  90                nop
0000066D  90                nop
0000066E  90                nop
0000066F  90                nop
00000670  90                nop
00000671  90                nop
00000672  90                nop
00000673  90                nop
00000674  90                nop
00000675  90                nop
00000676  90                nop
00000677  90                nop
00000678  90                nop
00000679  90                nop
0000067A  90                nop
0000067B  90                nop
0000067C  90                nop
0000067D  90                nop
0000067E  90                nop
0000067F  90                nop
00000680  90                nop
00000681  90                nop
00000682  90                nop
00000683  90                nop
00000684  90                nop
00000685  90                nop
00000686  90                nop
00000687  90                nop
00000688  90                nop
00000689  90                nop
0000068A  90                nop
0000068B  90                nop
0000068C  90                nop
0000068D  90                nop
0000068E  90                nop
0000068F  90                nop
00000690  90                nop

Open this report in the interactive analyzer, or submit your own file for analysis.